Malicious Url-false positive-?

Viruses and worms
1

I have started a thread here http://forum.avast.com/index.php?topic=83128.0 …to which i had found the culprit…Strangely it was the Mail Shield…After i deactivated the Mail Shield utorrent cpu usage is normal…I can live without the mail shield…if someone from avast consider it needs investigation i can send logs…etc what is required

The malicious url problem i noticed while i was deactivating shields one by one…I have this program installed emdb.exe from this url hxxp://www.emdb.tk/ .If the Web shield is installed than i can browse the site,but if i launch the program from pc it is stopped by network shield


http://thumbnails22.imagebam.com/14520/3dd508145198205.jpg

If the web shield is not installed than even browsing the site with firefox is not possible…both browsing the program site and launching the program from PC triggers the behaviour shield alert… I had sent here http://www.avast.com/contact-form.php?loadStyles yesterday the url but is still being detected…and the program needs internet connection to function…

I would like if possible at least this issue to be resolved…or i’ll have to uninstall Avast …Too much trouble ,even for free…

I have windows xp sp3 and avast 6.0.1203

2

setup.exe - 0/43
http://www.virustotal.com/file-scan/report.html?id=088515cef18e44cdfeb6d7612f0c1520c13ecefb9d2a3fbea11f28e7e4327760-1313431391

EMDB is a small utility to keep track of your DVD collection. With an automatic import from the database of IMDB, export to csv, text or complete website, thumbnail cover preview, a loan tracker, search function and multi-language user interface. EMDB is written in C++ using Microsoft Visual Studio 2008 and doesn't need a .NET framework or any other external libraries. And best of all... it's free!

URLVoid

Report 2010-07-02 06:30:35 (GMT 1)
Website emdb.tk
Domain Hash 840a9d1a8d3fd90a577b5786c96cef92
IP Address 94.103.151.195 [SCAN]
IP Hostname -
IP Country NL (Netherlands)
AS Number 25459
AS Name NEDZONE-AS NedZone Internet BV
Detections 0 / 17 (0 %)
Status CLEAN

Scanning site with: AMaDa CLEAN
Scanning site with: BrowserDefender CLEAN
Scanning site with: Finjan CLEAN
Scanning site with: Google Diagnostic CLEAN
Scanning site with: hpHosts CLEAN
Scanning site with: Malware Patrol CLEAN
Scanning site with: MalwareDomainList CLEAN
Scanning site with: MyWOT CLEAN
Scanning site with: Norton SafeWeb CLEAN
Scanning site with: ParetoLogic URL Clearing House CLEAN
Scanning site with: PhishTank CLEAN
Scanning site with: SURBL CLEAN
Scanning site with: Threat Log CLEAN
Scanning site with: TrendMicro Web Reputation CLEAN
Scanning site with: URIBL CLEAN
Scanning site with: Web Security Guard UNRATED
Scanning site with: ZeuS Tracker CLEAN

3

I know the program is clean…It’s site is being detected as malicious-which is i think a FP,and the program needs to connect to site to function correct

4

There is an on-line contact form, http://www.avast.com/contact-form.php?loadStyles for: * Sales inquiries; Technical issues; Website issues; Report false virus alert in file; Report false virus alert on website; Press (Media), issues.

If you are reporting an FP, then you get another input field open, enter the web URL for the site you wish to submit for review (network shield), etc.

  • Along with the URL give the info that it is being detected by the network shield a link to this topic should help them also.
5

This URL has been already unblocked in last VPS update (110815-1).